Description

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-20T12:17:05.403Z",
  "pubdate": "2026-09-20T12:17:05.403Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the Comfast CF-N1-S 2.6.0.1 Web Management Interface.\nThe vulnerability resides within the get_css_path_from_uri function located in the /cgi-bin/mbox-config file.\nThis flaw allows a remote, unauthenticated attacker to trigger a memory corruption condition by supplying a crafted URI.\nSuccessful exploitation can lead to a denial-of-service state or potentially remote code execution, depending on the architecture's memory protections.\nGiven that the exploit is publicly disclosed, the risk of active exploitation is significant, requiring immediate attention for exposed network devices.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow occurring within the Web Management Interface of the Comfast CF-N1-S, specifically during the handling of URI parameters.\nThe root cause is an improper bounds check within the get_css_path_from_uri function. This function fails to adequately validate the length of input data provided via the URI before copying it into a fixed-size buffer allocated on the stack.\nWhen an attacker submits a specially crafted request to /cgi-bin/mbox-config, the function processes the malicious URI segment. By providing an input string that exceeds the designated buffer size, the attacker can overwrite adjacent stack memory.\nThis overwrite can corrupt the function's return address and saved frame pointer. Upon the completion of the function execution, the CPU will attempt to restore the instruction pointer to a value controlled by the attacker, redirecting the execution flow to an attacker-supplied memory address.\nThe attack is remotely reachable as the /cgi-bin/mbox-config component is exposed via the web interface. Because the vulnerability exists within the processing logic of the CGI binary, it typically does not require prior authentication, allowing any network-adjacent entity to interact with the vulnerable function.\nPost-exploitation, the impact ranges from service instability, leading to a crash of the web management service, to full system compromise if the attacker successfully redirects execution to injected shellcode (e.g., Return-Oriented Programming chains if NX/DEP is enabled).\nThe disclosure of the exploit increases the risk, as automated scripts or threat actors can easily replicate the overflow condition to disrupt or take control of the affected networking hardware."
}